METHOD AND SYSTEM FOR DETECTING ANOMALY IN THE USAGE OF TRANSACTION CARDS OF A USER

FIELD OF THE INVENTION

[0001] The invention generally relates to the field of financial risk management. More specifically, the invention relates to a method and system for detecting anomaly in the usage of one or more transaction cards of a user.

BACKGROUND OF THE INVENTION

[0002] There have been numerous advances in the field of risk and fraud management. The technical advances assist consumers in safeguarding critical assets such as, but not limited to, transaction cards (e.g. credit/debit cards), passwords and account numbers.

[0003] Most of the technologies rely on ad-hoc information to detect fraud. Further, the detection usually happens after a suspicious event has occurred and by that time a consumer might already have lost the critical asset. In addition, the detection is generally limited to the card (s) of issuing organization which has a hosted transaction monitoring software server. Further, such detection is based on limited amount or type of information such as, but not limited to, card usage details. What would be ideal is to build a predictive analytics based on complete spending profile of the end user rather than according to a spend profile of card(s) restricted to one institution. As such, the detection is better done at a location where complete information is available.

[0004] In light of the above, there is a need for an improved method and system for detecting anomaly in usage of card based on financial transactions.

BRIEF DESCRIPTION OF FIGURES

[0005] The accompanying figures, where like reference numerals refer to identical or functionally similar elements throughout the separate views and which together with the detailed description below are incorporated in and form part of the specification, serve to further illustrate various embodiments and to explain various principles and advantages all in accordance with the invention.

[0006] FIG. 1 illustrates a system for detecting anomaly in the usage of one or more transaction cards of a user in accordance with an embodiment of the invention.

[0007] FIG. 2 illustrates a flow diagram of a method for detecting anomaly in the usage of one or more transaction cards of a user in accordance with an embodiment of the invention.

[0008] Skilled artisans will appreciate that elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. For example, the dimensions of some of the elements in the figures may be exaggerated relative to other elements to help to improve understanding of embodiments of the present invention.

DETAILED DESCRIPTION OF THE INVENTION
[0009] Before describing in detail embodiments that are in accordance with the invention, it should be observed that the embodiments reside primarily in method steps related to detecting anomaly in the usage of one or more transaction cards of a user of a user device.

[0010] In this document, relational terms such as first and second, top and bottom, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. The terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article or composition that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article or composition. An element proceeded by "comprises ...a" does not, without more constraints, preclude the existence of additional identical elements in the process, method, article or composition that comprises the element.

[0011] Generally speaking, pursuant to various embodiments, the invention provides a method and system for detecting anomaly in the usage of one or more transaction cards of a user of a user device. The user may have different transaction cards such as, but not limited to, one or more credit cards, one or more debit cards, and one or more shopping cards. There may be different anomalies in the usage of any of the one or more transaction cards of the user. Examples of anomalies in usage of a transaction card could be, using the transaction card for performing a transaction of an unusually high amount, using the transaction card for performing a transaction at a location where one usually does not transact, or using the transaction card at an unusual time. Such anomalies can be due to certain circumstances such as, when the transaction card is stolen, or when the user needs to perform such a transaction due to emergency, etc. The method enables detection of such anomalies in the usage of at least one of the one or more transaction cards of the user by creating a transaction intent profile for the user at the user device, and a spending profile for the user at the user device. The transaction intent profile for the user is created based on two or more intent messages transmitted by the user via the user device to one or more Transaction Processing Servers (TPS) over a period of time. Each intent message includes information associated with one or more intended transactions. The spending profile is created based on two or more transaction related messages received from one or more banks at the user device over the period of time. The method further includes comparing details of one or more transactions with one or more of the transaction intent profile, the spending profile and a user profile of the user to detect the anomaly in the usage of at least one of the one or more transaction cards.

[0012] FIG. 1 illustrates a system for detecting anomaly in the usage of one or more transaction cards of a user of a user device in accordance with an embodiment of the invention. System 100 includes a user device 102, a Transaction Processing Server (TPS) 104 and one or more banks such as, but not limited to, a bank 106-1, a bank 106-2 and a bank 106-n.

[0013] User device 102 can be a device such as, but not limited to, a mobile phone, a smart phone, a laptop and a handheld device. User device 104 is configured to facilitate interaction of the user with at least one of TPS 104 and the one or more banks.

[0014] TPS 104 can be a server hosted to facilitate in detecting the anomaly in the usage of at least one of the one or more transaction cards of the user. For instance, TPS 104 can be a server hosted by a service provider to provide a service for detecting anomaly in the usage of debit/credit cards.

[0015] User device 102 includes an application 108 for detecting the anomaly in the usage of at least one of the one or more transaction cards of the user (details regarding detecting the anomaly in the usage of at least one of the one or more transaction cards of the user are described in detail in conjunction with the description of FIG. 2). In accordance with an embodiment, TPS 104 is configured to authenticate the installation of application 108 on user device 102. Further, TPS 104 is configured to authenticate usage of application 108 such as for example usage of application 108 for transmitting a message from user device 102 to TPS 104.

[0016] Application 108 can be one of, but not limited to, a mobile application, and a computer application and a server based application. In an embodiment, application 108 is a mobile transaction surveillance engine. The mobile transaction surveillance engine is configured to detect the anomaly in the usage of the at least one of the one or more transaction cards based on one or more of call data record of the user device, one or more financial data record associated with the user, and application usage data of one or more mobile applications. Application 108 is configured to monitor at least one interaction between the user and at least one of TPS 104 and at least one of the one or more banks for detecting the anomaly in the usage of at least one of the one or more transaction cards of the user.

[0017] Application 108 is also configured to create at least one of a transaction intent profile of the user at user device 102, a spending profile of the user at user device 102, and a user profile of the user at user device 102 for detecting the anomaly in the usage of at least one of the one or more transaction cards of the user (details of the transaction intent profile, the spending profile, and the user profile, and creating the transaction intent profile, the spending profile, and the user profile are described in detail in conjunction with description of FIG. 2). Application 108 is further configured to enable storage of the created profile or profiles at one of user device 102.

[0018] In an embodiment, application 108 includes a profile builder component (not illustrated in FIG. 1). The profile builder component is configured to create at least one of the transaction intent profile of the user, the spending profile of the user and the user profile of the user. The profile builder component is configured to use heuristics such as, but not limited to, an artificial neural network, Bayesian network and inference engine for creating at least one of the transaction intent profile, the spending profile and the user profile.

[0019] Application 108 can also be configured to display an alert message on user device 102 if an anomaly is detected in the usage of at least one of the one or more transaction cards of the user. In addition, application 108 can be configured to send a notification to TPS 104 if an anomaly is detected in the usage of at least one of the one or more transaction cards of the user. Optionally, application 108 or TPS 104 can be configured to send the alert message to the corresponding bank in response to detection of the anomaly in the usage of at least one of the one or more transaction cards.

[0020] In an embodiment, application 108 is a server based application and interacts with TPS 104 for detecting the anomaly in the usage of at least one of the one or more transaction cards of the user. In accordance with the embodiment, the transaction intent profile, the spending profile and the user profile of the user are created and stored at a repository of or associated with TPS 104. In addition, in accordance with the embodiment, TPS 104 is configured to detect the anomaly in the usage of at least one of the one or more transaction cards of the user. Further, upon detecting the anomaly in the usage of at least one of the one or more transaction cards, TPS 104 can alert at least one of the user via user device 102 and at least one of the one or more banks associated with the at least one transaction card.

[0021] In addition to application 108, user device 102 can optionally include a location module (not shown in Fig. 1). The location module can be a Global Position Service (GPS) module. The location module can be configured to transmit information associated with location of user device 102 to TPS 104.

[0022] FIG. 2 illustrates a flow diagram of a method for detecting anomaly in the usage of one or more transaction cards of a user of a user device in accordance with an embodiment of the invention. The user device can be user device 102.

[0023] At step 202, a transaction intent profile is created for the user. The transaction intent profile of the user reflects the user behavior associated with communication of information regarding transactions that the user intends to perform in the future. The transaction intent profile of the user can be created at the user device based on a plurality of intent messages transmitted by the user via the user device to one or more Transaction Processing Servers (TPSs) over a period of time, wherein each of the one or more TPSs is a server such as TPS 104. Optionally, the transaction intent profile of the user can be created at at least one of the one or more TPSs based on the plurality of intent messages. The user can transmit each of the plurality of intent messages using an authorized user device application such as application 108, wherein the authorization can be performed by at least one of the one or more TPS.

[0024] Each of the plurality of intent messages can be one of, but not limited to, a Short Messaging Service (SMS) message and an email. Further, each of the plurality of intent messages includes information associated with one or more intended transactions. In an embodiment, the information associated with an intended transaction of the one or more intended transactions includes details such as, but not limited to, details of a transaction card that the user intends to use to perform the intended transaction, an intended transaction location, an intended transaction time period, an intended transaction date, an intended merchant category associated with the transaction, an intended number of purchases, and an intended transaction amount. For example, a user can send an intent message that the user is going to buy a movie ticket at around 8 PM and withdraw money from an Automated Teller Machine (ATM) at a location "X" at around 4 PM. An intent message can be automatically associated with a time limit and a geographic limit for a user. For example, if the user does not mention the intended location and the intended time limit in the intent message, then a time limit and a geographic limit can be automatically associated with the intended message. These limits can be used to determine user behavior. For instance, if a user very often deviates from performing the transaction in accordance with the details mentioned in the intent message, then the same can be reflected in the transaction intent profile of the user.

[0025] The transaction intent profile of the user can be created by analyzing the plurality of intent messages transmitted by the user over the period of time. The analysis can reveal different aspects of user behavior such as, but not limited to, the types of details the user generally provides in an intent message, the frequency at which the user transmits intent messages, and the probability that the user performs a transaction without communicating an intent message. For example, the analysis can reveal that the user always sends an intent message before performing a transaction. Alternately, the analysis can reveal that the user always provides a 15 minute transaction time period for performing a transaction.

[0026] In an embodiment, the transaction intent profile includes two or more sub-profiles, wherein each sub-profile corresponds to a particular user behavior. For example, a sub-profile can be specific to a transaction card or specific to weekday transaction intents or specific to weekend transaction intents of the user. Further, creating the transaction intent profile comprises creating the two or more of sub-profiles. In an embodiment, two or more transaction intent profiles are created for the user.

[0027] While it has been described that the transaction intent profile of the user is created based on the plurality of intent messages transmitted by the user over the period of time, there could be variations in the method of creating the transaction intent profile and as such those variations would be apparent to those ordinarily skilled in the art. For instance, for a new user, there may be no intent messages to analyze, and therefore a default profile may have to be used as the transaction intent profile for the new user. Taking another instance, there may be a user who sends intent messages only for a particular transaction type. Accordingly, it is possible that such a user may send only one intent message over a long period of time and therefore the transaction intent profile of such a user may accordingly have to be created based on the one message transmitted by the user. Taking yet another instance, it is possible that a user sends details associated with multiple transactions in one intent message. Accordingly, the transaction intent profile for such a user may have to be created based on one intent message including details of multiple transactions. There could be numerous variations in the manner in which the transaction intent profile can be created to determine the user behavior associated with communication of information regarding transactions.

[0028] At step 204, a spending profile is created for the user. The spending profile of the user reflects the spending behavior of the user, which can be determined by analyzing how the user performs transactions over a period of time. The spending profile of the user can be created at the user device based on a plurality of transaction related messages received from one or more banks at the user device over a period of time. Alternatively, the spending profile of the user can be created at at least one of the one or more TPSs based on the plurality of transaction related messages.

[0029] Each of the plurality of transaction related messages can be, but is not limited to, an SMS and an email. Further, each of the plurality of transaction related messages includes information associated with transaction details such as, but not limited to, details of one or more transactions, a user provided input associated with the one or more transactions, a merchant name, a merchant city, a transaction location, a transaction time, a transaction date, and a transaction amount. In certain countries, banks send messages to the user device to confirm transactions of the user. In countries where the banks do not send confirmation messages for transactions, the TPS directly polls with servers of the banks at periodic intervals on behalf of the user to check for ongoing transactions.

[0030] In an embodiment, the spending profile is created by deriving the spending behavior of the user. The spending behavior of the user can be a pattern in which the user uses at least one of the one or more transaction cards. For example, a user can have a spending behavior of spending 500 USD on the weekend for movies, dining and travelling, while spending only 50 USD during weekdays for dining.

[0031] In an embodiment, the spending profile is created for each transaction card of the user. Alternately, a single spending profile can be created for all the transaction cards of the user, which can be represented as a global spending profile of the user. In an embodiment, creating the spending profile includes creating the spending profile for each transaction card of the user and creating the global spending profile of the user. Further, one spending profile can be created for one type of cards. For example, one spending profile can be created for credit cards of a user and another spending profile can be created for debit cards of the user. In an embodiment, one or more spending profiles are created for the user of the user device based on factors such as, but not limited to, transaction location, transaction time and transaction amount. The one or more spending profiles can include profiles such as, but not limited to, a vacation spending profile, an entertainment spending profile, a grocery spending profile, a travel spending profile, a restaurant spending profile, a vehicle spending profile and a shopping spending profile.

[0032] In an embodiment, the method includes a step of creating a user profile. The user profile can be created at the user device or at at least one TPS. In an embodiment, the user profile is a device usage profile. The device usage profile of the user reflects a pattern in which the user uses the user device. One or more applications of the user device are monitored to create the device usage profile. For example, a pattern in which the user uses game applications in a day, or a pattern in which the user uses email applications in a week can be monitored. Further, the time spent on each application and the location of usage of each application is monitored to create the device usage profile. The one or more applications can be applications such as, but not limited to, mobile applications, computer applications and portable digital assistant applications. In addition, the one or more applications can be applications such as, but not limited to, a voice application, a data application, an audio application, a video application, a music application, an electronic book reader application, a browser application, and a social networking application. It would be apparent the one or more applications need not be limited to the examples described hereinabove and the different possible types of applications would be readily apparent to those ordinarily skilled in the art.

[0033] Additionally, a peer group profile across multiple users can be created based on variables such as, but not limited to, transaction counts with specific merchant categories, amounts transacted in a billing cycle and intent messages.

[0034] At step 206, details associated with one or more transactions are compared with at least one of the transaction intent profile, the spending profile and the user profile of the user to detect the anomaly in the usage of the at least one transaction card. Step 206 can be carried out at the user device or at at least one of the one or more TPS. The details associated with one or more transactions correspond to one or more of, but are not limited to, a transaction card detail, a transaction location, a transaction time, a transaction date and a transaction amount.

[0035] In an embodiment, at step 206, details associated with the one or more transactions are analyzed to determine if there is at least one intent message associated with the one more transactions. Consider a scenario where the transaction intent profile of a user suggests that the user always sends an intent message before performing a transaction. In such a scenario, if a transaction is performed without an intent message being transmitted beforehand, it can be determined that the transaction may not have been performed by the user or in case the user did perform the transaction, the user did not perform the transaction in the manner the user typically does.

[0036] The analysis, at step 206, includes comparing the user behavior for the one or more transactions with at least one of the transaction intent profile, the spending profile and the user profile. If there is any deviation from the user behavior in one or more of the transaction intent profile, the spending profile and the user profile, an anomaly is detected. In an embodiment, details associated with the one or more transactions are analyzed to determine if at least one of the one or more transactions corresponds to a portion of the transaction profile. The portion of the transaction intent profile corresponds to a predetermined user behavior such as, but not limited to, transaction intent during week days, transaction intent during weekend, transaction intent during vacation and transaction intent at a particular location.

[0037] The comparison at step 206 can determine if the one or more transactions are performed with the time limit and/or geographical limit associated with the intent message of the user. For instance, an intent message says that transaction should be performed within 24 hrs or within a 20 km radius. If any deviation is found in the time limit and/or the geographical limit associated with the intent message, then it may be concluded that there is an anomaly in the usage of a corresponding transaction card.
[0038] In an embodiment, the comparison at step 206 is performed by combining the spending profile of each transaction of the user (local multiple cards profiles) and the global spending profiles of the user.

[0039] In an embodiment, theft of the user device can also be detected if there is an anomaly in the device usage profile. For example, according to a device usage profile of a user, an e-book reader application is open in a mobile device everyday between 5PM to 6PM. If an intent message for a transaction is sent during 5PM to 6PM by the user using the mobile device, then it may be concluded that there is an anomaly in the device usage profile. This anomaly in the device usage profile can be an indication of theft of the mobile device.

[0040] In an embodiment, a consumer usage vector is built based on a call pattern, the spending profile, a geo-location pattern associated with the user, and the user profile. The consumer usage vector is used to compare details associated with the one or more transactions for detecting the anomaly in the usage of at least one of the one or more transaction cards. The consumer usage vector is shared with the TPS at periodic intervals to make sure that the user device is with the user. Thus, in case of theft of at least one of the one or more transaction cards or the user device, or both, fraud can be detected.

[0041] Additionally, information associated with location of the user device can be transmitted to the TPS. One or more location based content are identified and transmitted to user device based on the location of the user device. The one or more location based content can be content such as, but not limited to, advertisements, promotions, coupons, deals, discounts and offers. The one or more location based content can be identified based on one or more intent messages associated with the one or more transactions and the location of the user device. For example, bank location information can be used to send bank related advertisements directly based on the information associated with location of the user device.

[0042] Optionally, each new transaction due to which one or more anomalies have been detected can be scored. A threshold score can be defined for alerting the user or at least one bank corresponding to the transaction. If the score for the new transaction crosses the threshold score after comparing with the profiles of the user, then the alert is sent to the user and/or the at least one bank. For example, if a defined threshold score is 7 and the score of a new transaction is 4, then an alert is not sent to the user. Thus, false positive fraud detection can be reduced by scoring each new transaction.

[0043] Further, one or more actions such as, but not limited to, sending an alert to the user based on scores calculated for the one or more transactions, sending an alert to at least one of the one or more appropriate banks based on score of the one or more transactions, blacklisting the user, blocking at least one of the one or more transaction cards and stopping at least of the one or more transactions can be triggered if the anomaly in the usage of at least one of the one or more transaction cards is detected. If anomaly is detected in the usage of a transaction card, the user can be prompted to re-authenticate the transaction by providing credentials of the user such as, but not limited to, the user ID, the password and a photograph. For example, a user is using a credit card at a check-out counter of a shopping mall, and the transaction is suspected to be fraud, the user can be asked to enter the password for processing the transaction.

[0044] In embodiment, at least one of the one or more TPS maintains one or more global profiles, wherein at least one of the one or more global profiles includes details related to devices such as, but not limited to, Automatic Teller Machine (ATM) and merchant devices. For example, details related to an ATM can be number of transactions, transaction amount, number of transactions declined, and number of retries in a specific time slot of a day. The global profiles stored in the TPS can be used along with the spending profile of the user to detect anomaly in usage of at least one of the one or more transaction cards.

[0045] Consider an exemplary case where a user installs an application in a user device for detecting anomaly in the usage of transaction cards of the user. Once the application is installed, the application interacts with the TPS to authenticate the application. After the application is authenticated by the TPS, the user can send an intent message via the application with details regarding an intended transaction. The details regarding the intended transaction that the user provides in the intent message is "Shopping in 'X' mall after 3 hours. Transaction amount would approximately be 1000 USD". If after three hours, a transaction card of the user is used in any place other than 'X' mall, then a potential fraud is detected. The application alerts a user about the potential fraud. Alternatively, the transaction taking place at any place other than 'X' mall can be rejected by the corresponding bank of the transaction card or the user would be prompted to provide credentials to process the transaction.

[0046] The method and computer program product described herein can typically be implemented via a user device, and the invention thus contemplates a computer readable medium containing computer-readable instructions for performing the various embodiments described herein. In this regard, an embodiment of a computer-readable medium includes computer-executable instructions for detecting anomaly in the usage of one or more transaction cards of the user of the user device. The user device can be any computing device such as, but not limited to, a mobile phone, a smart phone, a personal digital access (PDA), a desktop computer, a general-purpose computer, a programmed microprocessor, a micro-controller, a peripheral integrated circuit element, and other devices or arrangements of devices, which are capable of implementing the steps that constitute the method of the invention. The computer-readable instructions can be stored in one or more storage elements in order to detect the anomaly. The storage elements may also hold data or other information as desired to perform the detection. The storage element may be in the form of a database or a physical memory element present in the computing device. The computer-readable instructions may be a set of instructions, wherein the set of instructions may include various instructions that instruct the computing device to perform specific tasks such as the steps that constitute the method of the invention. The set of instructions may be in the form of a program or software. The software may be in various forms such as system software or application software. Further, the software might be in the form of a collection of separate programs, a program module with a larger program or a portion of a program module. The software might also include modular programming in the form of object-oriented programming. The processing at the computing device may be in response to user commands or user actions, or in response to results of previous processing or in response to a request made by another computing device such as a TPS.

[0047] In accordance with the method and system disclosed herein, since the user voluntarily intimates about a transaction by sending an intent message prior to the transaction, the probability of transaction card fraud is reduced. The actual transaction records of the user are compared with the intent messages of the user to reduce transaction card fraud and theft. The information such as intended time, location and amount of transaction mentioned in the intent message can be used to validate purchases carried out using transaction cards. Apart from the prior announcement via intent messages, a transaction profile created for a user, which enhances the chances of detection of fraudulent transactions or theft of transaction cards. Further, since various embodiments of the invention use the transaction intent profile, the spending profile and the user profile, individually or in combination, the chances of detecting a fraud or potential fraud are even more enhanced. The invention chooses to build the complete spend profile of a user by capturing the same through confirmation messages sent to the user via email or SMS. The invention enables the user to label some specific patterns of cascaded event and time based behaviors into templates which can be pre-announced for fraud detection to be fool proof. The invention also eliminates risks of the whole process by encapsulating the device usage behavior into a consumer vector. In addition, theft of both transaction cards and user devices can be detected more effectively using various embodiments of the invention. Further, the method and system enable use of user devices such as mobile phones for detection of fraud or potential fraud by storing the transaction intent profile, the spending profile and the device usage profile, thereby making the method more personalized and dynamic.

[0048] The invention enables a client version of software to work in tandem with server software to synchronize global device and demography grouping profiles with specific targeted profile being predicted on device of a user. The invention introduces a hybrid technique of combining client device profile building with server's aggregated profile building capability at server level.

[0049] The invention uses the consumer vector profile information in a unique way to predict whether the current financial transaction is good or fraudulent. The invention integrates many diverse characteristics of a user into one consumer vector and also links the consumer vector to predict if the device or transaction card(s) is in the safe hands of the original owner.

[0050] Those skilled in the art will realize that the above recognized advantages and other advantages described herein are merely exemplary and are not meant to be a complete rendering of all of the advantages of the various embodiments of the invention.

[0051] In the foregoing specification, specific embodiments of the invention have been described. However, one of ordinary skill in the art appreciates that various modifications and changes can be made without departing from the scope of the invention as set forth in the claims below. Accordingly, the specification is to be regarded in an illustrative rather than a restrictive sense, and all such modifications are intended to be included within the scope of the invention. The benefits, advantages, solutions to problems, and any element(s) that may cause any benefit, advantage, or solution to occur or become more pronounced are not to be construed as a critical, required, or essential features or elements of any or all the claims. The invention is defined solely by the appended claims including any amendments made during the pendency of this application and all equivalents of those claims as issued.

CLAIMS
We claim:

1. A method for detecting an anomaly in the usage of at least one transaction card of a plurality of transaction cards of a user of a user device, the method comprising:

creating a transaction intent profile for the user at the user device based on a plurality of intent messages transmitted by the user via the user device to at least one Transaction Processing Server (TPS) over a period of time, wherein each of the plurality of intent messages comprises information associated with at least one intended transaction;

creating a spending profile for the user at the user device based on a plurality of transaction related messages received from at least one bank at the user device over the period of time; and

comparing details associated with at least one transaction with at least one of the transaction intent profile, the spending profile and a user profile of the user to detect the anomaly in the usage of the at least one transaction card.

2. The method of claim 1 further comprising transmitting information associated with a location of the user device to the at least one TPS, wherein the location of the user device is used for performing at least one of:

transmitting at least one location based content to the user device based on the location of the user device, wherein the at least one location based content is identified and transmitted by the at least one TPS, wherein the at least one TPS identifies the at least one location based content based on at least one of an intent message associated with the at least one transaction and the location of the user device; and

determining one or more merchant locations based on the location of the user device, wherein the one or more merchant locations are identified for targeting at least one location based content.

3. The method of claim 1, wherein creating the transaction intent profile comprises identifying a user behavior associated with communication of intent messages based on the plurality of intent messages transmitted by the user.

4. The method of claim 1, wherein the information associated with the at least one intended transaction comprises at least one of details of the at least one transaction card, an intended transaction location, an intended transaction time, an intended transaction date, and an intended transaction amount.

5. The method of claim 1, wherein creating the spending profile comprises deriving at least one spending behavior of the user.

6. The method of claim 1, wherein the spending profile is created for each of the plurality of transaction cards.

7. The method of claim 1, wherein each of the plurality of transaction related messages comprises information associated with at least one of details of the at least one transaction, a user provided input associated with the at least one transaction, a merchant name, a merchant city, a transaction location, a transaction time, a transaction date, and a transaction amount.

8. The method of claim 1, wherein the user profile is a device usage profile, wherein the device usage profile is created based on monitoring of at least one application of the user device.

9. The method of claim 8, wherein the at least one application is at least one of a voice application, a data application, an audio application, a video application, a music application, an electronic book reader application, a browser application and a social networking application.

10. The method of claim 8, wherein comparing details associated with the at least one transaction comprises creating a consumer usage vector, wherein the consumer usage vector is built based on a call pattern, the spending profile, a geo-location pattern associated with the user, and the device usage profile, wherein the consumer usage vector is built to detect the anomaly in the usage of the at least one transaction card.

11. The method of claim 1, wherein comparing details associated with the at least one transaction comprises determining if an intent message is associated with the at least one transaction.

12. The method of claim 11, wherein comparing details associated with the at least one transaction comprises analyzing the details associated with the at least one transaction to determine if the at least one transaction corresponds to a portion of the transaction intent profile.

13. The method of claim 1, wherein the transaction intent profile comprises a plurality of sub-profiles, wherein each of the plurality of sub-profiles corresponds to a particular user behavior.

14. The method of claim 1, wherein comparing details associated with the at least one transaction comprises analyzing the details of the at least one transaction, wherein the details of the at least one transaction correspond to at least one of a transaction card detail, a transaction location, a transaction time, a transaction date and a transaction amount.

15. The method of claim 1, wherein each of the plurality of intent messages is transmitted by the user by utilizing an authorized user device application.

16. The method of claim 1, wherein each of the plurality of intent messages is associated with at least one of a transaction time limit and a transaction geographic limit, wherein the transaction time limit defines the time limit for performing the at least one transaction, and wherein the transaction geographic limit defines a geographic limit for performing the at least one transaction.

17. The method of claim 1, wherein detecting the anomaly in the usage of the at least one transaction card comprises detecting an anomaly in the transaction intent profile and the spend profile of the user.

18. The method of claim 1, wherein the step of comparing details associated with the at least one transaction is performed at the user device.

19. A computer-readable medium comprising computer-executable instructions for detecting an anomaly in the usage of at least one transaction card of a plurality of transaction cards of a user of a user device, the computer-executable instructions when executed by at least one processor, cause the at least one processor to:

create a transaction intent profile for the user at the user device based on a plurality of intent messages transmitted by the user via the user device to at least one Transaction Processing Server (TPS) over a period of time, wherein each of the plurality of intent messages comprises information associated with at least one intended transaction;

create a spending profile for the user at the user device based on a plurality of transaction related messages received from at least one of the at least one TPS at the user device over the period of time; and

compare details associated with at least one transaction with at least one of the transaction intent profile, the spending profile and a user profile of the user to detect the anomaly in the usage of the at least one transaction card.

20. The computer readable medium of claim 19, wherein the computer-executable instructions are embodied in a mobile transaction surveillance engine of the user device, wherein the mobile transaction surveillance engine is configured to detect the anomaly in the usage of the at least one transaction card based on at least one call data record of the user device, at least one financial data record associated with the user, and at least one mobile application usage data.